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Includes CAO feedback changes 
COURSE: -FSHSIANF) OVSC1205 Special Training on FISA (Analytical) | 
Module 6: (U) The Analytical Work Role 


DATE/PREPARER: Topic Page Classification Page Number 
(U) Module TOP-SECRETISHINOFORN 1 of 12 
Introduction 


FRAME ID: 6010 
(U) Module 6 


(U) The Analytical Work Role 
NEXT FRAME ID: 6020 


(U) This module will enable you to: 


e (FS#SIHNF}-Identify how BR and PR/TT fit into the analytic workflow 


PAOK PRANE IE: RE e CSHSIYNE) Recognize how BR and PR/TT authorities apply to real-life scenarios 
ALT TAG: 


GRAPHIC/AV: 


(FSHSWHNE) (OGC Attorney): Throughout the first five modules of our course, we have discussed the BR and PR/TT Orders and the policies and 
procedures NSA has implemented to provide reasonable assurance of compliance with the Orders. We also have looked at the community of people and 
the work roles that are involved across the Enterprise to support that aspect of the mission. 


(FSHSIHNE) (HMC Character): This part of our trip is designed specifically for anyone working in an analytical role, or supervising staff in an analytical role, 
in support of the BR and PR/TT Bulk Metadata Programs. In particular we will discuss facets of BR and PR/TT that are of interest to analysts and HMCs. 
This module will enable you to: 
e  (FSHSWHNE) Identify how BR and PRITT fit into the analytic workflow 
(FSHSH/NE) Recognize how BR and PR/TT authorities apply to real-life scenarios 
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DATE/PREPARER: Topic Page Classification Page Number 
(U) The CT Analyst’s Toolkit FOR SECRETISHINOFORN 2 of 12 


FRAME ID: 6020 
(FSHSHANF) BR and PR/TT Programs enable NSA to fill collection gaps left by our other 
authorities 


NEXT FRAME ID: 6030 


BACK FRAME ID: 6010 
ALT TAG: 


GRAPHIC/AV: 

(FSHSWNE) (Display introductory 

images/graphics pertinent to the Zazi 

story). 

(FSHSWNE) Graphic showing the portfolio 

of CT authorities with BR and PR/TT 

highlighted. Possible video footage of the 

arrest. 

(FSHSHINE) (HMC Character): In Module 1, we mentioned that in order to gain comprehensive insight into a target’s activities, it is often necessary to 
leverage multiple authorities and tools. CT targets have maintained an ongoing desire to conduct attacks within the United States. Given the unique U.S.- 
focus of the BR and PR/TT Programs, NSA is able to fill collection gaps left by our other authorities. 


(FSHSHINE) To illustrate how these various authorities can complement each other to fill critical gaps, as well as to show how BR and PR/TT fit into the 
analytic workflow, we'll step through the example of Najibullah Zazi and the New York subway plot. 
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DATE/PREPARER: Topic Page Classification Page Number 
(U) Applying BR and PRAT in FOP-SECRETISHMOEORN 3 of 12 
the Analytic Work Flow 


FRAME ID: 6030 


NEXT FRAME ID: 6040 


BACK FRAME ID: 6020 
ALT TAG: 


GRAPHIC/AV: 

(FSHSWHNE) Graphic showing the portfolio 
of CT authorities with BR and PR/TT 
highlighted 


(FSHSHINE) (HMC Character): 
external operations 
tasked the address to FAA 702 and reviewed the subsequent traffic on a regular basis. 


(FSHSIHNE) In Fall of 2009, one particular piece of content collection obtained from FAA 702 revealed an email exchange between a Pakistan-based target 
and an unknown individual suggesting that an unspecified terrorist operation was about to take place. Within this email, the analyst also discovered what 


appeared to be a U.S.-based phone number that was missing the country code. _.----77'| Comment [a1]: Graphic of 2 terrorists sending 
email to each other, show email indicating threat and 
containing a number without country code 
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DATE/PREPARER: Topic Page Classification Page Number 
(U) Applying BR and PRAT in FOP SECRETISHINOFORN 4 of 12 
the Analytic Work Flow 


FRAME ID: 6040 


NEXT FRAME ID: 6050 


BACK FRAME ID: 6030 
ALT TAG: 


GRAPHIC/AV: 

(FSHSHNE) Graphic showing the portfolio 
of CT authorities with BR and PR/TT 
highlighted 


NSA reported the suspicious activity and minimized U.S. phone number in a standard EGRAM. After 
receiving the unminimized U.S. phone number through NSA’s Identity Release process, the FBI learned that the user of the unknown email address and 
owner of the phone number was a Colorado-based individual named Najibullah Zazi. FBI immediately started an investigation into Zazi’s activities. _...--| Comment [a2]: Maybe show report or something 
similar -B Mito send serial numbers 


FOPSEEREHSHNOFORN 
Page 4 of 12 


DATE/PREPARER: Topic Page Classification 
(U) Applying BR and PR/TT in FOP -SECRETISHAIOFORN 
the Analytic Work Flow 


FRAME ID: 6050 


1 
|: Zazi is the user off 


[According to SIGINT reporting 
NEXT FRAME ID: 6060 la Pakistan-based al-Qa'ida (AQ) facilitator, 
[received an email from Nanpullan Zazi on 6 


BACK FRAME ID: 6040 
ALT TAG: 
GRAPHIC/AV: 


(U) Show graphic of the RAS equation 

here. 

(FSHSHANF) Graphic showing the portfolio 

of CT authorities with BR and PR/TT 

highlighted 

(U) Highlight the important parts of the 

statement 

(FSHSHANE) (HMC Character): Simultaneously, to gain a fuller picture of Zazi’s contacts, an NSA CT analyst submitted a RAS-approval request to an HMC 

on Zazi’s phone number and email address. Recall from Module 3 that, in order to meet the RAS standard, an identifier must be tied to specific Ill 

see In this case, the analyst met the RAS stan {ajd By paging the | stification on the fact that Zazi was in direct 

communication with the Pakistan-based email address used by a member of Because Zazi is a U.S. person, after the RAS 

requests on Zazi’s identifiers were reviewed by an HMC, they were then sent to OGC, who performed a First Amendment review and gave the final 

approval. -| Comment [a3]: Graphic of RAS template 
Comment [chr4]: With the RAS ‘template’ are 


(FSHSHINF) When considering RAS, analysts should remember to include just the basic facts needed with supporting documentation, as was done in thé we going to pull up the key items in text bubbles or a 
Zazi case, and not clutter the justification with excess information or documentation. ‘cloud’ ala the rainbow slide presentation? 
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DATE/PREPARER: Topic Page Classification Page Number 
(U) Applying BR and PRAT in FOP SECRETISHAIOFORN 6 of 12 
the Analytic Work Flow 


FRAME ID: 6060 


NEXT FRAME ID: 6070 


BACK FRAME ID: 6050 
ALT TAG: 


GRAPHIC/AV: 

(FSHSWNE) Graphic showing the portfolio 
of CT authorities with BR and PR/TT 
highlighted 

(U) Use screen shots to illustrate main 
points 


(FSHSHNE) (HMC Character): After the RAS requests were approved, using the BR and PR/TT modes of EE CT analysts began running federated 
metadata queries on the approved identifiers, as we discussed in Module 4. The analyst querying Zazi’s Colorado phone number discovered that around 
the time that Zazi exchanged emails with the =i he had also contacted hone numbers. Using the 
guidance that we discussed in Module 4, the analyst determined that Zazi’s contacts with these M iuiibers were unique to BR metadata. Based on 
this uniqueness, the analyst began drafting a report in accordance with the dissemination guidell we reviewed in Module 4. Before the report was 


released, the Chief of $12 determined that the report met the CT Nexus criteria and approved its release. -| Comment [a5]: Use one of screenshots showing 
what a chain/query looks like 


(FSHSIHNE) Remember, even “fact of’ statements describing what BR- or PR/TT-unique data was discovered are considered “query results” under FISC 
guidelines and must be handled in accordance with the Court Orders. However, once formally disseminated to customers, it no longer requires the 


Tbrotection and is treated as normal SIGINT analysis, as is the case with the example we have just described. 
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DATE/PREPARER: Topic 
(U) Applying BR and PR/TT in 


the Analytic Work Flow 


Page Classification 
FOP SECRETISHAIOFORN 


Page Number 
7 of 12 


FRAME ID: 6070 


NEXT FRAME ID: 6080 


BACK FRAME ID: 6060 
ALT TAG: 


GRAPHIC/AV: 


points 


(FSHSHANF) (HMC Character);| 
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DATE/PREPARER: SLS 


FRAME ID: 6080 


NEXT FRAME ID: 6081 


BACK FRAME ID: 6070 


ALT TAG: 


GRAPHICIAV: 


Topic Page Classification Screen Number 
(U) Knowledge FOR-SEGRETISHAICFORR 8 of 12 
Check 1 


{U} Knowledge Check 


1. GASASIANF) In the Zazi scenario, analysts used E.O. 12333 and FAA 702 collection to support RAS. 
Which source(s) can be used to support RAS? 

a) (U) FBI reporting 

b) (U) Open source information 

c) (FSHSHANE) NSA FISA collection 

d) (U) All the sources above can be used 


2. (FSHSIANF) Why was the RAS request for Zazi sent to OGC for a First Amendment review? 
a) FS#HSI4NS AII RAS requests go to OGC fora First Amendment review 
b) 4-SHSHINE) Zazi is a U.S. person 
c) 4SHSHANF) Zazi is a member of al-Qa'ida or an associated terrorist group 
d) (TFSHSHNE) The RAS determination was a close call 


(U) (HMC Character): Let’s make a few notes in our travel journal and check to see what you remember from this topic! 


Question 1. (U#FOLIO) Correct! Any information that is lawfully in our possession may be used to support a RAS determination. 
(U#EOUO) Incorrect, the correct answer is d). Any information that is lawfully in our possession may be used to support a RAS determination. 


Question 2, (UZESO) Correct! A First Amendment review is only necessary when the identifier is believed to belong to a U.S. person. 
U#FOUG) Incorrect, the correct answer is b). A First Amendment review is onl when the identifier is believed to belong to a U.S. 
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DATE/PREPARER: SLS Topic Page Classification Screen Number 
(U) Knowledge TOR SECRETHISH/NOFORN 8 of 12 
Check 1 


FRAME ID: 6081 (U) Knowledge Check 


3) (FSHSHANE) In this scenario, information was discovered that was unique to the BR authority. If that same 
information had also been discovered in E.O. 12333 collection, a CT Nexus determination would still need to 
be made in order to disseminate that information because the information was in the BR repository. 


NEXT FRAME ID: 6100 a) (U) True 
b) (U) False 


4) (FSHSWHNE) Why are students without] EE | allowed to learn that Zazi had contact with other New 


York numbers? 

BACK FRAME ID: 6080 a) (FSHSH/NF) That information is not specific enough to qualify as | 
ALT TAG: b) (FSHSHANF) The information is over one year old 

` c) {FSHSHINE) The information has been previously disseminated outside of NSA 
d) (FSHSHANF) It is being shared for training purposes 


GRAPHIC/AV: 


(No audio or transcript on this page) 


Question 3. (FSHSH/NE) Correct! If the same information is discovered through another source, neither the BR nor PR/TT rules and requirements apply. 
(FSHSH/NE) Incorrect. The correct answer is b) (False). Neither the BR nor PR/TT rules and requirements apply if the same information is discovered 
through another source. 


Question 4. (FSHSHANF) Correct! The information can be disclosed to those without I |p ecause it has previously been disseminated outside 
of NSA. 

(FSHSIHNEF) Incorrect. The correct answer is c). The information can be disclosed to those without a... because it has previously been 
disseminated outside of NSA. 
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DATE/PREPARER: SLS Topic Page Classification Screen Number 
(U) Practice Scenario 1 FOR SEGRETISHINOFORN 9 of 12 


FRAME ID: 6090 (U) Practice Scenario 1 


(FSHSWNE) You are a mm cleared analyst who, through PR/TT metadata analysis of seeds associated 
with a high value CT target, has identified a PR/TT-unique direct contact — email address 
believed to be used by someone in Yemen. You, are not sure whether the identifier warrants further development as 
NEXT FRAME ID: 6100 a target, but to find out you place EE ina tasking database to enable content collection from 
E.O. 12333 sources. This tasking database Is widely availaple to all intelligence analysts in the SIGINT Production 
Chain. For this reason, you note in the comments field that this identifier was discovered through metadata analysis 
and is believed to be a direct contact of the high value CT target, but you deliberately avoid identifying the PR/TT 
metadata as the source of the identifier. Are your actions in compliance with the terms of the PR/TT Orders? 
BAUK FRAME ID: 0031 


ALT TAG: (U) Please select the your answer: 


a) (FSHSWHINE) Yes, because you did not include the reference to PR/TT. 


GRAPHIC/AV: b) (FSHSIANEF) No, because you failed to mark the source of the identifier as PR/TT metadata. 
c) {(FSHSIUNB) Yes, because the results will be governed under E.O. 12333 rules and procedures. 


d) {FSHSHHNF)} No, because you have shared a PR/TT-unique a, wide audience 


of intelligence analysts, many of whom do not hold curren — redentials. 


(U) (HMC Character): Now let’s practice what we have learned using a real-life scenario. Carefully read the scenario and then select the best answer. 


ANSWER: 

a) (FSHS!NE) Incorrect. The correct answer is d). No, because you have shared a PR/TT-unique query result with a wide audience of intelligence 
analysts, many of whom do not hold current BE edentials. 
(FSHSHINE) Incorrect. The correct answer is d). No, because you have shared a PR/TT-unique query result with a wide audience of intelligence 
analysts, many of whom do not hold current ME credentials. 
(FSHSHINE) Incorrect. The correct answer is d). No, because you have shared a PR/TT-unique query result with a wide audience of intelligence 
analysts, many of whom do not hold current ME credentials. 
(FSHSIANF) Correct! The right answer is d). No, because you have shared a PR/TT-unique query result with a wide audience of 
intelligence analysts, many of whom do not hold current HIM Ec rcdentiais. 
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DATE/PREPARER: 


FRAME ID: 6100 


NEXT FRAME ID: 6110 


BACK FRAME ID: 6090 


ALT TAG: _ 
GRAPHIC/AV: 


Topic Page Classification Page Number 
(U) Summary FOR SECRETISGHMOFORM 10 of 12 


(UY#FOUO) You should now be able to: 


e COSHSHINE) Identify how BR and PR/TT fit into the analytic workflow 
e (CSHSHINE) Practice applying BR and PR/TT authorities in real-life scenarios 


(TS//SI//NF) If you have questions or wish to find out more, please contact you 
leared manager or any of the following BR or PR/TT points of contact: 


OGC email alias: DL gc_ops 


OGC Phone: EEE Or 963-3121 (s) 
OGC website: go GC 
HMCs email alias: DL CT_HMC 


SID Oversight and Compliance email alias: DL SV42_all 


(U#E QUO) (HMC Character): Now that we have completed this part of our road trip, you should be able to: 
e (FSHSHNE) Identify how BR and PR/TT fit into the analytic workflow 
e = (FSHSHINF) Practice applying BR and PR/TT authorities in a real-life scenario 


(FSHSHANE) (HMC Character): You are encouraged to reach out to vour mcer manager or any of the points of contact listed here if you 
have any questions or if you want to find out more. Please remember that it is critical to our mission that we are 100% compliant with the requirements in 
the Court Orders especially with regards to collaborating, sharing, and disseminating this data through the course of your analysis work. You may review 
this course at any time and seek guidance from any of the points of contact listed here. 
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DATE/PREPARER: SLS Topic Page Classification Screen Number 
(U) Next Step FOR SECRETHSHNGFORN 11 of 12 


(U) PLEASE READ: Important Assessment Information 


(U) You will view the questions in a separate Assessment Questions Document 


NEXT FRAME ID:N/A 
U) You will enter your responses in a separate QuestionMark online answer sheet 


BACK FRAME ID: 6100 U) You will have only one attempt to successfully complete the assessment 


ALT TAG: 


GRAPHIC/AV: U) Allow yourself sufficient time (approximately 30 minutes) to complete the assessment 


(U) To Complete the Assessment: 


+ (U) Click the link to open the Assessment Questions Document Comment [SLS6]: Please make this a links that, 
will open ue Assessment ueslion pal Lor 
Analytical Personnel (we will acmally connect. the 
link later), 

a (U) Go tothe VUport SumTotal Content Player page, click on the Assessment link, and follow the 


instructions to complete the required exam 


(UFROUO) (OGC Attorney): The final part of your trip will be to successfully complete the assessment for the course. Please be aware that for the 


assessment you will view the questions in a .pdf file and enter your responses in a separate QuestionMark online answer sheet. Please be sure that you 
open the .pdf with the questions first before opening the QuestionMark online answer sheet. You will have one attempt to complete the assessment. Please 
allow yourself sufficient time (approximately 30 minutes) to complete the assessment. 


(U#FOUS) Please click the Assessment Questions Document link to open the .pdf question file and keep the window open. Then go to the VUport 
Sum Total Content Player page, click on the Assessment link on the left, and follow the instructions to complete the required exam. 
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